ALAS2027-2026-313

References: CVE-2026-82247  CVE-2026-82249 
FAQs regarding Amazon Linux ALAS/CVE Severity

Issue Overview:

Package updates are available for Amazon Linux 2027 that fix the following vulnerabilities:
CVE-2026-82249:
gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL.

CVE-2026-82247:
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1).

Issue Correction:
Run dnf update rust --releasever 2027.0.20261109 or dnf update --advisory ALAS2027-2026-313 --releasever 2027.0.20261109 to update your system.

New Packages:

aarch64:
    rustfmt-debuginfo-1.99.1-1.amzn2027.aarch64
    rust-analyzer-debuginfo-1.99.1-1.amzn2027.aarch64
    rust-debugsource-1.99.1-1.amzn2027.aarch64
    clippy-debuginfo-1.99.1-1.amzn2027.aarch64
    cargo-debuginfo-1.99.1-1.amzn2027.aarch64
    rust-debuginfo-1.99.1-1.amzn2027.aarch64
    rust-std-static-1.99.1-1.amzn2027.aarch64
    rustfmt-1.99.1-1.amzn2027.aarch64
    clippy-1.99.1-1.amzn2027.aarch64
    rust-1.99.1-1.amzn2027.aarch64
    rust-analyzer-1.99.1-1.amzn2027.aarch64
    cargo-1.99.1-1.amzn2027.aarch64
    rust-doc-1.99.1-1.amzn2027.aarch64

noarch:
    rust-std-static-wasm32-unknown-unknown-1.99.1-1.amzn2027.noarch
    rust-toolset-srpm-macros-1.99.1-1.amzn2027.noarch
    rust-lldb-1.99.1-1.amzn2027.noarch
    rust-gdb-1.99.1-1.amzn2027.noarch
    rust-debugger-common-1.99.1-1.amzn2027.noarch
    rust-toolset-1.99.1-1.amzn2027.noarch
    rust-std-static-wasm32-wasip1-1.99.1-1.amzn2027.noarch
    rust-src-1.99.1-1.amzn2027.noarch

src:
    rust-1.99.1-1.amzn2027.src

x86_64:
    rust-debuginfo-1.99.1-1.amzn2027.x86_64
    rust-std-static-1.99.1-1.amzn2027.x86_64
    clippy-debuginfo-1.99.1-1.amzn2027.x86_64
    rust-debugsource-1.99.1-1.amzn2027.x86_64
    rust-analyzer-debuginfo-1.99.1-1.amzn2027.x86_64
    rustfmt-debuginfo-1.99.1-1.amzn2027.x86_64
    cargo-debuginfo-1.99.1-1.amzn2027.x86_64
    rustfmt-1.99.1-1.amzn2027.x86_64
    clippy-1.99.1-1.amzn2027.x86_64
    rust-analyzer-1.99.1-1.amzn2027.x86_64
    cargo-1.99.1-1.amzn2027.x86_64
    rust-1.99.1-1.amzn2027.x86_64
    rust-doc-1.99.1-1.amzn2027.x86_64